Baylor Scott & White Medical Center - Frisco

An unauthorized third party obtained administrative-level credentials through a business associate (BA) of Baylor Scott & White Medical Center – Frisco, the covered entity (CE). The incident remained contained within the BA’s network and compromised the protected health information (PHI) of 39,850 individuals from September 22 through September 29, 2018. The types of PHI involved in the breach included demographic and financial information. The CE provided breach notification to HHS. Affected individuals, and the media. OCR’s investigation found that the CE maintained an updated BA agreement with its BA and that, upon learning about the breach, the CE discontinued its relationship with the compromised network, including terminating access to CE’s PHI.